vault

type Material struct {
	APIKey    string
	Workspace string
	BaseURL   string
}

type Options struct {
	// DisableInline rejects credential refs with backend=inline.
	// Intended for hosted-service deployments where operators must
	// use env/file/external vault backends so secrets never land in
	// control-plane records or logs. Driven by the
	// MCP_DISABLE_INLINE_SECRETS env var.
	DisableInline bool
}